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Abstract 
O . 

2^ ' We quickly review labelled Markov processes (LMP) and provide a counterexam- 

ple showing that in general measurable spaces, event bisimilarity and state bisimi- 
larity differ in LMP. This shows that the logic in Desharnais [3] does not characterize 
state bisimulation in non-analytic measurable spaces. Furthermore we show that, 
under current foundations of Mathematics, such logical characterization is unprov- 
able for spaces that are projections of a coanalytic set. Underlying this construction 
there is a proof that stationary Markov processes over general measurable spaces 



o 

Y^ • do not have semi-pullbacks. 



> ■ 1 Introduction 

CNi: 

One of the more interesting facts about the state of the art on Markov decision processes 
lO ' over a continuous state-space is that there exist a number of competing notions of hisimu- 

l/-^ ■ lation. The essential difference with the discrete case is the appearance of nonmeasurable 

^ . sets, which e.g., inhibit the possibility of extending straightforwardly Larsen and Skou 

[15] notion of probabilistic bisimulation. 

To work in a concrete setting, we will use the framework of Labelled Markov Processes 
(LMP). LMP have a labelled set of actions that encode interaction with the environment; 
thus LMP are a reactive model in which there are different transition subprobabilities for 
each action. The thesis |3| contains a thorough study and introduction to LMP. 

The categorical approach to bisimulation is already present in Joyal et al. [12| and 
was studied for LMP in j^. There, the notion of zig-zag morphism was defined and 
the relation of bisimilarity was given by a span of zig-zags. Zig-zags are exactly the 
coalgebra morphisms for Giry's functor H [9|. The major obstacle for this definition of 
bisimulation was that transitivity of bisimilarity was proved by using structure results 
only available when the state-space is analytic. This was done in [^ by using a technical 
result by Edalat J8| that constructed a span of zig-zags given a cospan. To achieve this 
goal, Edalat established explicitly the existence of regular conditional probability for the 
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universal completion of a Polish space. An alternative point of view, restricted to the 
category of Polish spaces, can be found in Doberkat |5|. 

A Hennessy-Milner logic was also developed and in (^ it was proved that the relation of 
bisimilarity was characterized by this logic in the case of an analytic state-space. Clearly, 
a notion of logical equivalence must be transitive, so the problem of transitivity is more 
general than that of the logical characterization of bisimilarity. 

It was realized that a new notion of bisimulation was needed, and in [2| Danos, Deshar- 
nais, Laviolette, and Panangaden defined event bisimulation in terms of the measurable 
structure of LMP. They proved that logical equivalence and event bisimilarity coincide 
and that both can be phrased as a cospan of zig-zags. These results are in a way conse- 
quences of the fact that cospans are far more easy to work with in a coalgebraic setting. 

In this paper, we construct a counterexample showing that in general measurable 
spaces, event bisimilarity and state bisimilarity differ in LMP. This shows that the 
Hennessy-Milner logic used in [^, y, |2| does not characterize bisimulation in non-analytic 
measurable spaces. The construction includes also a counterexample to the existence of 
semi-puUbacks in the category of stationary Markov processes over general measurable 
spaces. 

The construction of our counterexample needs the existence of a nonmeasurable set. 
It is known that it is consistent with current foundations of Mathematics that there 
exists a nonmeasurable subset of the Euclidean plane which is the continuous image of the 
complement of an analytic set. Hence, there are spaces in level 2 of the projective hierarchy 
of sets (level occupied by Borel sets, level 1 by analytic sets and their complements) for 
which the logical characterization bisimulation is unprovable. 

The paper is organized as follows. In Section |2] we review some background to our 
study, including some concepts related to measurable spaces and prior results on labelled 
Markov processes. Section |3] develops the consequences of Los and Marczewski's theorem 
on extension of measure, in particular the non-existence of semi-puUbacks in the category 
of stationary Markov processes and zig-zag morphisms. Our main counterexample, a LMP 
for which event and state bisimilarity differ from each other, is constructed in Section |H 
A careful analysis of the set theoretical requirements of this construction is pursued in 
Section [5l where we show our unprovability result. 

2 Background 

2.1 Measurable spaces 

A (T-algebra over a set S* is a family of subsets of 5" closed under countable union and 
complementation. Given an arbitrary family U of subsets of S, we use cr(W) to denote 
the least cr-algebra over S containing U. 

Let {S,S) a measurable space, i.e., a set S with a a-algebra S over S. We say that 
{S, S) (or S) is countably generated if there is some countable family U (^ S such that 
S = a{U). Assume now that V d S. We will use Sy to denote cr({\^} US), the extension 
of S by the set V . It is immediate that 

Sv = {(5i n y) u {B2 n V) : 5i, B2 e S}. 



The sum of two measurable spaces {Si, Si) and (5'2,52) is (^i © 5*2, iSi © S2), with the 
following abuse of notation: 5*1 © 5*2 is the disjoint union (direct sum qua sets) and 
>Si © ^2 = {Qi ®Q2-Qi^Si}. We obtain: 

{S,Sv) = {V,S\V)®{V^,S\V^). (1) 

It is obvious that if S is countably generated so is Sy- 

If y is a topological space, B(y) will denote the a-algebra generated by open sets in 
Y, hence {Y, B(F)) is a measurable space, the Borel space of Y. 

The central example (see Theorem [3]below) is the Borel space of the open unit interval 
I := (0,1). The a-algebra B(I) is countably generated: it is generated by the family 
B := {Ba : a G w} of all open subintervals of I with rational endpoints. This family 
has a property which is inherited by the whole cr-algebra: we say that a family of sets 
S C Pow(S') separates points if x,y are distinct points in S, then there is A G 5 with 
X E A and y ^ A. Hence B(I) separates points. We have the following propositions; the 
first of them is immediate and we will use it without reference. 

Proposition 1. ForU C Pow(S'), U separates points if and only if a(U) does. 

Proposition 2 (12.1 from [14]). The following are equivalent: 

1. {S,S) is isomorphic to some {Y,'B{Y)), where Y is separable metrizable. 

2. {S,S) is countably generated and separates points. 

A topological space is Polish if it is separable and completely metrizable. Examples 
of Polish spaces are the Euclidean spaces M" and all countable discrete spaces. Polish 
spaces are closed under countable product, and hence the Baire space M := N^ is Polish, 
assuming N discrete. We have the following fundamental result (see [14, 15.6]): 

Theorem 3 (The Isomorphism Theorem). Let Y be an uncountable Polish space. Then 
the Borel space ofY is isomorphic to (I, B(I)). 

Finally, an analytic (or S}) space is the continuous image of a Polish space. 

2.2 Labelled Markov Processes 

The following definitions are extracted from Danos et al. J2]- 

Let {S, S) be a measurable space. Recall that a Markov kernel on a measurable 
space {S,S) is a function r : 5 x 5 — )■ [0, 1] such that for each fixed s E S, the set 
function t(s, ■) is a (sub-) probability measure, and for each fixed X E S, r(-,X) is a 
(iS,B([0, l]))-measurable function. 

Now let L be any set. 

Definition 4. A labelled Markov process (LMP) is a structure S = (S*, 5, {r^ : a G L}) 
where (5", S) is a measurable space and for a G L, r^ : S* x 5 — t- [0, 1] is a Markov kernel. 
We will call L the set of labels and {S,S) the base space of S. 

Labelled Markov processes form a category whose arrows are given by zig-zag mor- 
phisms. 



Definition 5. Let S = {S,S, {t^ : a e L}) and S' = {S',S', {t^^ : a e L}). be LMP. A 
zig-zag morphism / : S — )■ S' is a surjective measurable map / : {S,S) — )■ {S',S') such 
that for all a G L we have: 

yseS^QeS': r„(s, f-\Q)) = r:(/(s), Q). 

The reader may find variants of this definition along the development of the theory. In 
LMP are augmented with an initial state and zig-zags are not required to be surjective 
but to preserve initial states. Later in [^ the authors adopt thepresent definition. 
However, these are minor differences. More fundamentally, both |3|, |j] require the state 
space to be analytic. We refer the reader to Desharnais [3] for motivation and for the 
fundamental results in the theory of LMP. 

Some notation concerning binary relations will be needed to state the formal defini- 
tions. Let R a binary relation over S. A set Q is R-closed ii Q 3 x R y implies y E Q. 
S{R) is the a-algebra of i?-closed sets in S. Lastly, let U he a subset of Pow(5'). The 
relation TZ (U) is given by: 

(s, t) e 7^ (W) ^^ 'iQeU-.seQ^teQ. 

Fix a LMP S = (5,5, {t^ : a e L}). 

Definition 6. 1. A relation R (1 S x S is a state bisimulation on S if it is symmetric 
and for all a E L, s Rt implies WQ G S{R) : Ta{s, Q) = Ta(t, Q). 

2. An event bisimulation on S is a sub-a-algebra U oi S such that {S,U, {r„ : a G L}) 
is a LMP (i.e., r^ is W-measurable for each a E L). We also say that a relation R is 
an event bisimulation if there is an event bisimulation U such that R = TZiU). 
If there is a state (event) bisimulation R such s R t, we will say that s is state- 
(event-) hisimilar to t. 

It is proved [3, Proposition 3.5.3] that whenever there exists a zig-zag morphism / 
between two LMP S and T, the equivalence relation generated by the pairs (s, f{s)) with 
s G S' is a state bisimulation on the sum S © T|^ On the other hand, for every state 
bisimulation i? on a LMP S, the identity map Id : (S", 5, {xa : a G L}) — )• {S,S{R), {tq : 
a G L}) is a zig-zag (see |2|, Lemma 4.2]). 

A generalization of the notion of event bisimulation will be needed in the sequel: 

Definition 7. A subfamily W C 5 is stable with respect to S if for all A G W, r G [0, 1] 

and a E L, {s E S : Ta{s, A) > r} E U. 

Since a function / : 5 — > [0, 1] is measurable if and only if f^^{{r, 1]) is a measurable 
set for every r E [0, 1], an event bisimulation on S is the same thing as a stable sub- 
cr-algebra of S. This notion of stability was further generalized by Doberkat |6| to the 
concept of congruence for stochastic systems. 



^The base space of the sum S © T is {S,S) © {T,T) and the transition function t^®'^ {r, A) equals 
rf (r, AnS)iir€S, and T^{r, Ar]T)iireT. 



It is shown that there exists a greatest state bisimulation ~ (namely, the relation of 
state bisimilarity) , and in [2] it is proved that event bisimulation is characterized by the 
logic C given by the following productions: 

ip = T \ ipiAip2 \ {a)q'ip 

where a E L and g G Q fl [0, 1]. Formulas in £ are interpreted as sets of states in which 
they become true as follows: 

[T] := S [y.1 A ip2J := [y^il H {^2} l{a),^ := {s e S : r,(s, M) > q} 

Let |£] := {If} : (/^ G £}. Two states s,t G S are logically equivalent if s 7?.(|£]) t, i.e., 
if they satisfy exactly the same formulas. Given a class Ai of LMP, the problem of the 
logical characterization of bisimulation for Ai is to prove the following statement: 

For all S G A^ and all s,t G S', s 7^(|>C]) t if and only if there exists a 
bisimulation R such that s R t. (We say that C completely characterizes 
bisimulation) o 

This depends on how do we qualify the word "bisimulation" . In the case of event bisim- 
ulation, we have the following results: 

Theorem 8 ([2|, Proposition 5.5]). cr(|£]) is the smallest stable a-algebra. 

Theorem 9 ([2!, Corollary 5.6]). cr(|£]) is the least event bisimulation, and hence the 
logic C completely characterizes event bisimulation. 

In view of this result we conclude that the problem of the logical characterization of 
state bisimulation is equivalent to decide if event and state bisimilarity coincide. This 
was also proved in J2| for the class of LMP having an analytic base space. To obtain this 
result, one needs the logic £ to be countable, hence also limiting the set of labels L to be 
at most countable. It is noteworthy that the counterexample of Section H] conforms this 
restriction. 



3 Extensions of measures 



The reader can consult Royden [17| and Rudin [l8j as general references for Measure 
Theory. 

The key idea in the construction of our counterexample is the possibility of extending 
the domain of definition of a (probability) measure in a very flexible way. We will use 
a result due to Los and Marczewski [16| concerning canonical extensions of measuresBlf 
S <^ U and fi, v are measures defined on {S,S), {S,U) (respectively), we say that z/ 



^Perhaps a better phrasing would be "characterization of bisimilarity", but we keep this one in 
accordance with previous works. 

•^Los and Marczewski use the term "measure" to mean a finitely additive set function while reserving 
"cr-measure" for a standard (cr-additive) measure. In any case, they prove the result for both finitely 
and countably additive set functions. 



extends fi to {S,U) when i^|5 = /i. We recall that the inner and outer measures defined 
from /i, denoted /Xj and /Xg respectively, are the countably subadditive functions given by 

IJi{A) := sup{/i(M) ■.MCA,MeS} ^e(^) := inf {/i(M) : M D A, M G 5}, 

for every A ^ S. 

It is well known that the domain of definition of a measure /z can be enlarged to 
include all subsets A for which fii{A) = fie{A); such sets are called n-measurahle and 
they form a a-algebra. In the case of Lebesgue measure, we will use the name "Lebesgue 
measurable sets" . By using the Axiom of Choice it can be proved the existence of sets 
in Euclidean space that are not Lebesgue measurable. For such sets the following results 
are most significant. 

Theorem 10. Let fi be a finite measure defined in {S,S), and let V C S. Then/j, and fi 
defined as: 

ijiE) = fii{Env) + fie{Env') 
fi{E) = fi,{Env) + fi,{Env') 

for every E ^ Sy are measures that extend /i to {S,Sv) and satisfy: 

Proof. By Theorems 4, 2, and 1 in [16]. The proof follows elementarily from these facts: 

1. For all A, E such that AnB = and AUB e S we have iJ,i{A) + ji^iB) = iJ,{A + B) 
(see, for instance, flOi, 14.11]). 

2. For Ej G Sy (j G u) pairwise disjoint there are Mj,Nj G S such that Ej = 
{Mj n V) U {Nj n V^) and Mj (Nj) pairwise disjoint. 

3. If Aj C Mj with Mj G S pairwise disjoint, then fiiiXJj Aj) = J2j f^ii^j) ^^^ 

D 

Corollary 11. Let fi be a finite measure defined in {S,S) and let V (^ S be non fi- 
measurable. Then there are extensions /ii and fi2 to Sy of fi such that fii{V) ^ fi2{V). 

Proof. Immediate by definition of (non) yU- measurable set. D 

At this point it is possible to give a hint for the failure of the logical characterization 
of bisimulation. The logic can be seen as an encoding for the family |£] of measurable 
sets, which can be enlarged to the a-algebra cr(|£]). This a- algebra cannot "weigh" a 
set V which is not measurable "respect to cr(|£])"; more precisely, one can have two 
measures that are equal on cr(|£]) ("logically equal") but they differ on cr(|£])y. 

With this tool at hand we are now ready to witness a failure for the existence of semi- 
pullbacks [81] in the category of (labelled) Markov processes over general measurable spaces 
and zig-zag morphisms. A category has semi-pullbacks if for every diagram consisting of 
objects Si, S2 and T and arrows /j : S, — )- T (i = 1, 2; a cospan) there exists an object S 
and arrows ttj : S — )■ Sj (a span) such that /i o vti = /2 o 7r2. Recall also that a stationary 
Markov process [8] is a LMP with a single Markov kernel (i.e., the label set is a singleton). 
We have: 

6 



Theorem 12. The category of stationary Markov processes and zig-zag morphisms does 
not have semi-pullbacks. 

Proof. Let m be Lebesgue measure on the closed interval I := [0, 1], let S := B(I), and 
let y be a subset of 1 that is not Lebesgue measurable. Take two extensions mo and 
mi of m to Sv such that moiV) ^ mi(V^) as in Corollary [TTl Let xm be the indicator 
function of the set M C 1. This function is 5y-measurable if and only if M G Sy. Now 
define 



C(r,A) 
B{r,A) 



X{o,i]{r) ■ So{A) + X{o}(r) ■ mo{A) 
X{o,i]{r) ■ 6o{A) + X{o}{r) ■ mi{A) 
X{o,i]{r) ■ 6o{B) + X{o}{r) ■ m{B), 



for every < r < 1, A G Sy and B & S. We will prove that C is a Markov kernel over 
(1, 5y); the proofs for 6 and that r is a Markov kernel over (1, 5) are exactly analogous. 
To accomplish this, we have to check that ({r, ■) is a (sub)probability measure for each 
r G I, and C('; ^) is measurable for each A E Sy- 

The first part is immediate since C{r,-) is a convex linear combination of two proba- 
bility measures on (l,Sy), namely Dirac's ^o concentrated at and mo- For the second 
part, just observe that ({■, A) is well defined for A E Sy and it is a linear combination of 
iSy-measurable real functions, hence 5y-measurable. 

(5,S,p) 

/ / ^9 

/ \ 

/ \ 




Figure 1: A semi-pullback. 

Now let Si := (1, 5y,C), S2 := (1, 5y,6') and T := (I, iS,r). The identity maps 
/c? : Sj — 7- T are obviously zig-zag, since mo and mi agree with m over S. We will see 
that there are no S := (S*, S,p) and zig-zag morphisms / and g that make the diagram 
in Figure [T] commutative. 

If such / and g exist, they must be equal as functions from 5 to 1 because of the 
commutativity of the diagram. Now let m G S" such that f[u) = (recall that a zig-zag 
is surjective). Hence g{u) = 0. By the definition of zig-zag, we have: 

p{u, f-\V)) = C(0, V) = moiV) ^ m,{V) = 9(0, V) = p(w, g-\V)) 

From this we reach a contradiction, since we have f~^{V) = g^^{V). D 

Given the relation between semi-pullbacks and regular conditional probabilities (cf. 
|8|), this failure of existence of semi-pullbacks can be traced to the fact that if mi{V) = 



and mf.{V) = 1, then there is no regular conditional probability for ^{m + m) on B(I)y 
given B(!) (see [H, p. 81] and 0, p. 624]). 

From Theoren iJT2] we infer that the method of proof (i.e., the construction of a semi- 
pullback) used in j^ to show the logical characterization of bisimulation cannot be applied 
in non-analytic spaces. It could be argued that the existence of semi-puUbacks is not 
equivalent to the transitivity of bisimulation defined as a span of zig-zags. In spite of 
this, in the next section we will see that this sort of extension of measures ensures that 
the transitivity of bisimilarity cannot be proved in general. 

4 The counterexample 

Following the same line of thought of the proof of Theorem [T21 let m be Lebesgue measure 
on I, let 5 := B(I), and let \^ be a subset of I that is not Lebesgue measurable. Take two 
extensions mo and mi of m to Sy such that mo{V) ^ mi{V). Let s,t,x ^Ihe mutually 
distinct; we may view mo and mi as measures defined on the sum I© {s, t, x}, supported 
on I. Recall that S is generated by the countable family B := {Ba : a G u}. 

Let L3 := a; U {00}. Now define a LMP S3 = (5*3,53, {r^ : a G L3}) such that 

(^3, S3) := (I © {s, t, x}, Sv © Pow({s, t, x})), 

roo(r. A) := X{s}ir) ■ mo{A) + X{t}{r) ■ mi{A) 

when a & u and A G 1S3. 

Lemma 13. S3 zs a LMP. 

Proof. We have to check that for all i E L-^, T£{r, ■) is a subprobability measure for each 
r G 5*3, and Ti{-,A) is measurable for each A E S3. 

The first part follows from the fact that for all r, < XBa(^) ^ 1 ^^d < X{s}{f^) + 
X{t}{r) < 1. 

For the second part, we infer measurability by the same reasoning in the proof of 
Theorem [T^ T£{-, A) is always a linear combination of measurable functions. D 

Lemma 14. s and t are event-bisimilar. 

Proof. We will check that s and t will not be separated by a certain stable a-algebra U. 
Hence they cannot be separated by the smallest such cr-algebra, which is (as a relation) 
the greatest event bisimulation. 

Let U := (t{B U {{s, t}, {x}}). As it easily seen from the proof of Lemma [T^ Ta{-, A) 
is W- measurable for all a E u and A G 1S3 (a fortiori, for A ElA). Since mo and mi are 
equal on cr(B(I) U Pow({s, t,a;})), for every A ElA, Too{,s,A) = rooit,A), and hence for 
any B C [0, 1], s belongs to roo(-, A)~^{B) if and only if t does. D 

Theorem 15. Event and state bisimilarity differ in S3. 



Proof. To prove them different it is enough to show that s and t are not state-bisimilar 
(and hence event bisimilarity is not included in state bisimilarity) . The strategy is simple: 
we show that state bisimilarity on S3 is the identity relation, and hence cannot contain 
the pair (s, t). 

It is easy to show that the singleton formed with the (only) null state x must be an 
~-class. For any other r G S3, there exists i E L3 such that Ti{r, S^) = 1 but r^i^x, S3) = 
(and 5*3 is obviously ~-closed). Now take y 7^ 2; in I; we will show that y and z cannot 
be related by ~. Since B generates B(I), there exists a E u C L3 such that Ba separates 
y from z. Without loss of generality, assume {y, z} H Ba = {y}. Then Ta{y, {x}) = 1 but 
Ta{z, {x}) = 0. We conclude that ~ restricted to lU{a;} is the identity and (in particular) 
y C I is ~-closed. 

It remains to observe that Too{s,V) 7^ Taoit,V), and hence s and t are not state- 
bisimilar. n 

Corollary 16. The logic C does not characterize state bisimulation for LMP having a 
non-analytic base space. Moreover, the logical characterization of state bisimulation fails 
for the class of LMP having separable metrizable base spaces. 

Proof. The first assertion is immediate from Theorem [T^ Since ^3 is countably generated 
and separates points, the second assertion follows from Theorem [T^ and Proposition[21 D 

It is known that in a general coalgebraic setting state bisimilarity (defined as the 
existence of a span of zig-zags) is transitive, provided the functor preserves weak pullbacks 



19|. By dropping alternatively states s and t in S3 one may show that this is not the 



case for LMP over general measurable spaces. 

Corollary 17. The relation of bisimilarity (as given by a span of zig-zags) is not transitive 
for general measurable spaces. 

Sketch of proof. Let S3 \ {s} = {S3 \ {s}, 531(5*3 \ {s}), {t^ : a G L3}) be the result of 
"deleting" the state s from S3, let S3 \ {t} = (5*3 \ {t},iS3|(S'3 \ {t}), {t^ : a G L3}), and 
T = {S3 \ {s}, S © Pow({t, x}), {fa : a G L3}), where fa and Ta coincide for a G a; and for 
A G5©Pow({t,a;}), 

foo(t. A) = m{A), f^{r, A) = ioi r ^ t 

(note that in T we are restricting ourselves to measurable subsets of the form B (B X, 
where B E S = B(I) and X C {t, x}). The identity map Id of 5*3 \ {s} and the the map 
F : 5*3 \ {t} — )■ 5*3 \ {s} which sends s to t and such that F\{\ © {x}) is the identity, are 
zig-zag morphisms Jc? : S3 \ {s} — >■ T and F : S3 \ {t} — )■ T, respectively. Hence both 
S3 \ {t} and S3 \ {s} are state-bisimilar to T, but they are not state-bisimilar to each 
other. n 

We can recast this last corollary in our relational framework for bisimulation and show 
a serious categorical drawback of the concept of state bisimilarity: it is not reflected by 
direct sum. 



Example 1. Consider the LMP S3 \ {s} and S3 \ {t} from the proof of Corollary [T71 and 

let T' = {{S3 \ {s,t}) U {t'},S ® Pow({t',a;}), {fa : a e L3}) be the result of renaming t 
to t' in T. Then s and t are state-bisimilar in the sum U := S3 \ {t} © S3 \ {s} © T' but 
in S3 \ {t} © S3 \ {s} they are not. 

Indeed, it is immediate that s, t are not state-bisimilar in S3 \ {t}©S3 \ {s} by using 
the argument of Theorem [TBI But in the sum S3 \ {t} © S3 \ {s} © T' they are. Take the 
equivalence relation R whose classes are {s, t, t'} and all other triples having corresponding 
elements in each of S3 \ {t}, S3 \ {s}, and T'. Then i? is a state bisimulation. For this, 
note that if ([/, U) is the base space of U, then every W-measurable i?-closed subset of U 
must be of the form {B (B B (B B)U F, where -B C B(I) and F a finite set (in particular, 
V cannot be the (S3 \ {t})-part of a set in U{R)). For these sets the transition functions 
behave identically. 

Hence, state bisimilarity in LMP over general measurable spaces has an undesirable 
non-local character. One possible conclusion of this would be to abandon state bisimi- 
larity and to use the event-based version, which is the main point of [2|. But one must 
not overlook that the artifact of using a non Lebesgue measurable set is rather tricky: 
the Banach-Tarski Paradox, stating that a ball of radius 1 can be decomposed in finitely 
many pieces that can be reassembled to form two balls of radius 1, relies on the same 
device. We therefore should ask under what circumstances we may encounter a non 
Lebesgue measurable set. We discuss this in the next section. 

5 Further analysis of the construction 



We know by the work of Desharnais et al. |^ that in the class of LMP over analytic 
spaces, the logic C indeed characterizes state bisimulation and hence (obviousljo) our 
construction must give a non-analytic base space. It is then natural to ask if by imposing 
some regularity assumptions on the base space we can be certain to avoid the pathological 
examples of the previous sections. 

Since our counterexamples need a non Lebesgue measurable subset to start with, the 
first question is how complex should be the base measurable space {S,S) as to allow 
non /i-measurable subsets among the sets in S. The measure of "complexity" we are 
taking into account is the place S occupies in the projective hierarchy of Descriptive Set 



Theory |14l . Ill| . The first level of this hierarchy is inhabited by analytic sets and their 
complements {coanalytic or II} sets). We will only be interested in the first two levels, 
so we give the formal definition of the class of sets in level two and state some of their 
properties. 

Let X be a Polish space. A subset of X is in H\{X) if it is expressible as a projection 
of the coanalytic set: 

T\{X) = {proj;^(C) : C coanalytic in X x Y, Y Polish}. (2) 

A set is in Ul{X) if its complement is 'El{X); finally define A2(X) := 'Sl{X) n n2(X). 
We say that a measurable space {S,S) is Sg (resp., 112, ■^2) if there exists a Polish 



Recall Lusin proved [14|, Theorem 21.10] that every analytic subset of R is Lebesgue measurable. 
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space X and r e ^^X) (resp., Ul{X), A^(X)) such that {S,S) ^ {Y,B{X)\Y). All 
these classes of sets are closed under countable unions and intersections and stable under 
restriction (if X C y are both Polish and T is S2, Ul, or A2, then r(y)|X C r(X)). 
Moreover, since the class of Polish spaces (and their Borel spaces) are closed under sum, 
this property is inherited by S2, 112 ^^^ ^^2 measurable spaces. 

Since every Polish space is the continuous image of the Baire space M, it can be proved 
that in Eq. ([2]) we can replace Y by A^. Given this preponderant role of the space of 
functions from N to N, recursion theory has an impact in the development of descriptive 
set theory by the introduction of the lightface hierarchy E^, 11^ and A^; here the notion 
of closed set is replaced by an effective one. We repeat the definitions in |lll . 25.1]. 



Definition 18. 1. A set A C A/" is S]; if there exists a recursive set R C |J^o(^" ^ ■^") 
such that for all x = (xq, Xi, . . . ) G Af, 

X e A <^^ 3y e M^n G N : R{x\n, y\n), 

where x\n := (xq, . . . , Xn-i)- 

2. Let a G A/". A set A C A/" is S}(a) (S} in a) if there exists a set R recursive in a 
such that for all x G A/", 

X E A 4=^ 3y G J\f\/n G N : R{x\n, y\n, a\n). 

3. A C AT is U^ (in a) if A^ is S^ (in a). 

4. A C Af is S^_^^ (in a) if it is the projection of a 11^ (in a) subset of A/" x J\f. 

5. A C Af is Al^ (in a) if A is both S^ (in a) and 11^ (in a). 

We have 

Ki^f) = U ^nia). 

aeAf 

This notions can be extended to subsets of M" and in particular we obtain S2(]R") C 
S2(M") (as well as H^ C Ul and A^ C Ag). 

The reason for stopping at level 2 of the projective hierarchy is that a classical result 
by Godel shows it is consistent with current foundations of mathematics (as given by 
Zermelo-Fraenkel set theory with Choice, ZFC) that we may find a A.\ measurable space 
with non Lebesgue measurable sets in its cr-algebra. Actually, it is consistent with ZFC 
that there exists a A2(]R^) set that is not Lebesgue measurable. 

More precisely, Godel's axiom constructibility V = L (which is relative consistent 
with ZFC) implies by Theorem 25.26 in Jech [11!] and subsequent Corollary 25.28 that 
there exists a A2 relation on M (i.e. a set W in A2(M^)) such that (M, W) is a wellorder 
isomorphic to (a;i,<), where Ui is the first uncountable ordinal. And it is known that 
such a relation W cannot be Lebesgue measurable as a subset of M^. From this set we 
will be able to reconstruct our counterexample. 

Firstly, we manufacture a subset of I x I that is not Lebesgue measurable. 

Lemma 19. It is consistent with ZFC that there exists a (Lebesgue) nonmeasurable subset 
W zn A^(Ix I). 
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Proof. By the preceding discussion, it is consistent to assume W G A2(M^) and (M, W) = 
(cji, <). As a consequence, M and I are both equinumerous with Ui. Define W to be the 
restriction of W to I, i.e., W = W H (I x I); we have W G A2(I^). Again, we obtain a 
wellorder (I, W) of type ui. Finally, a standard argument shows that such a W cannot 



be a Lebesgue measurable subset of I^ (see, for example [13|, Sect. 17.1]). D 



By using this set W the construction of our counterexample can be carried out with 
inessential changes. 

Theorem 20. The logical characterization of state bisimulation cannot be proved (on 
ZFC basis) for the class of LMP with Ag base spaces. 

Proof. In the construction of Section HI we may replace I by I^ with no trouble since 
B(I^) is likewise countably generated (e.g. take E to be the family of open squares with 
rational vertices). Hence we now have S := I^ and S := B(I^). 

Observe that S C ^\(^) and since A2(I^) is closed under intersection and comple- 
mentation, the sets 5 n VT' and 5 n W'^ belong to A2(I^) for B eS. By Equation ([1]), 

{l\Sw') = {W',S\W') © {W'\S\W'') 

is the sum of two Ag spaces, hence a Ag space it is. 

The construction of {8^,33) will then result in a A2 space since it is the sum of 
{I'^,Sw') and a discrete space. D 

Theorem [20] places a limit on what can be proved in ZFC alone. Since the Axiom 
of Constructibility cannot be proved in ZFC, we only know that it is consistent that an 
LMP such as S3 can be constructed over a A2 space. 

6 Conclusions & an Open Problem 

We constructed a LMP over a non-analytic measurable space in which state bisimilarity 
and event bisimilarity differ from each other. Since the latter is completely characterized 
by the modal logic C, we have a LMP such that state bisimulation is not characterized 
by C Among the consequences of this construction we recall the non-locality of state 
bisimulation: state-bisimilarity is not reflected by direct sum. 

We also showed that it is consistent relative to Zermelo-Fraenkel set theory with 
Choice (ZFC) that the logical characterization of bisimulation cannot be proved for the 
class of LMP having A.^ base spaces. This was accomplished by means of a classical result 
of Godel that shows the consistency of the existence of a A2(M^) set that is not Lebesgue 
measurable. Ag sets lie in the second level of the projective hierarchy (the flrst one 
being occupied by analytic and coanalytic subsets of Polish spaces) and for uncountable 
spaces, this hierarchy has oj levels properly. So this cuts out the possibility of proving 
the logical characterization of state bisimulation for "almost every" projective space in 
the ZFC framework. 

We face two possibilities: to abandon state bisimulation completely in favour of the 
event based one; or to consider extending our mathematical foundations. In the second 
scenario, one may investigate the consequences of the axioms of determinacy. These 
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provide a smooth theory for the structure of analytic and projective subsets of Pohsh 
(resp., standard Borel) spaces and they are gaining wide acceptance. In particular, the 



axiom of Analytic Determinacy (AD) (see 1J| for details) implies that every set in 5]2fM"') 
or n2(M") is Lebesgue measurable and enjoys various other regularity properties^! A 
successful application of AD in this situation will probably depend on presenting the 
problem of the logical characterization (or those problems that imply it, like the existence 
of semi-puUbacks or regular conditional distributions) as an infinite game over an analytic 
space. 

A more fundamental question is whether we actually need a non Lebesgue measurable 
set to furnish such a counterexample, but we do not have an answer yet. Coanalytic sets 
are Lebesgue measurable, and hence the immediate problem is to decide whether the 
results in |^, |2| can be extended to the class of LMP with coanalytic base spaces. 
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